Recent vs. Summary

The two menu groups, recent and summary, both have the same subpages of Alerts, Address, Host Name, and File, but they serve two different functions.

Recent pages show a daily summary of all (or a searched subset) of the pages attribute. To see all the alerts in the last 24 hours, you would use the recent->alert pages.

Summary shows a single attribute and its pattern over time. If there is a particular address, you can search that address and see the summary for that address over multiple days.

Normally, people do not navigate to summary pages directly. Most of the time when you see an alert, address, hostname, or file, there is a dropdown interface that allows you to navigate to the summary of that attribute.

However, sometimes there is a need to search for a particular attribute not knowing if it's in the database. This is when the summary page should be used directly.

Using the summary page allows you to search over long ranges of time faster than if you were to perform the same search on the flow page.

‚Äč